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imm^) mm 
[»^«i] 

mi} 

• G : WERT — </>^ 

. . . 

• 5 € Z, ^/i' = 1 (€ F) 



• Or 



-1 € Z 




, , ^ • • • (^2) 

• or € Z 

i:S<2)illit (H,g,h,a) $:f^^b (-EL, mpq<D \f h , 
(1) ^-fi^ti, ¥:S:m(eH)feJ:t?$Li5CrlcMLT, 

C = m-g^, D = h^ {€G) • ' ' ®5[3) 



$:ftmt, $ ^>lcBt-^:^:*^b¥:it7t)^-«^l5^c=^■^'^l:$tl-g>fe^?3©'hf*DMa^tf- 
(2) mm'^mmu, ^^ommm (H,s,a~b stm^^t, Hgf-^:ic(c,D,a)*^e> 



1 
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m = {dyy ' (€ H) 



m.4) 





[«^^2] 

M^«11CJ3V%T, tffSH^glW# (G,g,h,a) li, mm^m^t>^&f^h, 
Ih-^X, 



^UM 2000-301 1 680 
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[|5f5] 

• p, g • l^f&, P = 3 (mod 4), g = 3 (mod 4) 

• « e Z, ffA" = 1 (mod p?) ... (g[5) 

• j9 € Z, a/? = 1 (mod lcm{p — 1, g - 1)) 

(p,q,s,^) $^IC, 

• a,5,fe,fc,/€Z (0<5,/K») 

• • • (MG) 

^-S^^H (n,g,h,k,I,a) $:f^fifeL (ML, klipqOl^-vy h^R) , 
(1) i^-e^tt, ¥:i:iii(0<m<2*'"2) j3J:t/gLilCr (O^r^I) iC^bT, 
[fit 7] 

C = m'^ff^' mod n, jD = A'^' mod n • • • ®:7) 




^tf^L, $ e>{CJacobifH-^a=(in/Ti)?rft^L, (C,D,a) ^rBgf-^li: ^ L T BufB§:# 
(2) luiB^«#lt, (p,q,s,/S) $:MV^T, Bir#:S:(C,D,a)3bNp, 



n.,, = (CP-)^ mod _ _ 



mi,, = (CjD ) * mod q 



* (»l,p''»l,q)''^' (-"'l,p''»l,q)''^ (•»l,p.-"'l,q).<^(-»l,p.-«'l,q)<^ 
^l|{CJ:SZ/(p)XZ/(q)*^e>Z/(pq)/\©3ml^M^^?:^■ro ) , 

3 mil#2 0 0 0 - 3 0 1 1 6 8 0 




»^]g5^Cfc^^T, BUlB^gllf^ (n,g,h,k,l,a) \t, ttfiaSM#*'^^^ 

• p,q : P = 3 (mod 4), g = 3 (mod 4) 

• • • (js9) 

• 5 € Z, aj0 = 1 (mod lcm(p - 1, g - 1)) 




[til 0] 

• „ = /9 (d tt^) 

(1) mm^ii, ¥:icm (0<m<2""^b IC^LT, 

mill 



m, = mO*=» « G{r) \\r(B H{mO^' © C?(r)) {0 < mj < 2*= ') 



OSl 1) 



$:tf-»L (-OL, G: {0,1} ''^^ {0,1}", H: {0,1} {0,1} liJg^^^^^'A 

k=n+kQ+2 i: ^ c ) , $ lCJacobiga-^a=(inj/n), iBJ^Xf, 

mi 2] 

C = mi2» mod.n, • • • GSl 2) . 
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(2) talBSM#li, S#a)SJ^it (p,q,iS) $:Mv^T, B&-^i:(C,a)*^ e^, 

[f5fl 3] 

£l£±ii 

mi^g = C * mod g 




l?J^^iglCj:SZ/(p)XZ/(q)*>P>Z/(pq)^(Z)^|^M¥#S:*-ro ) . 

^^IZ, iii'j=s'||t' (s' Itm' ^(D±&.nify f tiT^kQ^'^ ^ iZMLX, 
mi 4] 

® C7(t' ® if («'))]»-*» if [i/ © G(f ® /r(5'))]fc, = 0*« ^ ^ ^ ^ 

m = ^ _ • • • (Sci 4; 

otherwise 





»^^7^CfeV^T, iUfB^^«# (n,k,a) tt, tuiB^^^^^^fig L, ^Am^t 
mi 5] 

^ Pi g ' JP ^ 3 (mod 4), g = 3 (mod 4) 

♦ s € Z, ^/i' = 1 (mod pg) - • - (ISl 5) 

♦ j8 e Z., aj9 = 1 (mod lcm(p - 1, ^ - 1)) 



^«>8J^ii (p,q,s,)S) ^rf^fi^L, $e>tC, 



2000-3011680 
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a,g,h,k,l€Z {0 < g,h < n) 



mi 6) 



{d ti^) 



tjt^'^mm: (n,g,h,k,l, a) ^j^mi^ iUL, ntpqCDlfvhM) , 
(1) ¥:5C« (0<m<2""^b ICMLT, 

mi 7] 

m, = mO'* © G(r) II r ® F(mO*» ® C?(r)) (0 < < 2*"') •♦•^17) 




^tmV G: {0,1}^°^ {0,1}", H: {0,1} "--{0,1}^°, 

ti'efey, k=n+kQ+2 S o ) , $ ?>lCJacobifS-^a=(inj/n), 
[fill 8] 

C = mi^i;'"' mod n, D = h^' mod n • • • ^1 8) 



(2) BuIBSMli, (P,q,s,/S) ?l:iSV^•t, Bf-^I^: (C,D,a);b^ t 




[|gCl 9] 



mij, = (CI?*) « mod J), •••aS19) 
mi,, = (CZ?*)^ mod g 



$:lt^L. *('»i,p."'l,q).* (-"'l,p.»l,q)'* ("'l,p'-"'l,q)'*(-"l,p'-"'l,q^® 

(x/n)=a7!)^oO<x<2*'"2$:^fe■rx$:B' LTimb * litf^fflA® 

!H^^S^Ci:-2>Z/(p)XZ/(q)7b^bZ/(pq)^CDig[^M¥^&^•to ) , 

$e>{C, m'j=s'|it' is' itui' ^(D ±&.n\f V h , t' liT^kptf b ) IC^UT, 
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m2o] 



m 




[s' ® G{t' ® ® G{l' ffi = 0*1 



otherwise 



• - • m20) 



[|f:^^l 0] 



1 1 ] 

[tJ[2 1] 



W#^9lCS3tNT, tuiH<i5i|§ffi# (n,g,h,k,a) it, tuiES^#*^^^ L, ^ 



1^, p = 3 (mod 4), 9 = 3 (mod 4) 




- - • m2 2) 



• ;3 € Z, ajS = 1 (mod lcm(p — 1, 9 - 1)) 



(p,q,s,/s) Sr-f^^L, $e>^c 



[8J[2 2] 



• n = p"*? (d fi^^) 



• • • (»22) 



(n,g,h,k,l, a) ^i^mL mV, klipq^tf «y h:R) , 
(1) mm^li, ^:^Cm (0<n.<2") IC^LT, 



ffilEilt 2000-301 1680 
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m2 3i 



® G{r) II r ® {m ® G{r)) (0 < mi < 2*-') 



0^2 3) 




^tfM-L mV, G: {0,1}^°-^ {0,1}", H: {0,1} "-^{0,1}^°, Itmm ^Jt ^ y ^' 
SCT'^y, k=n+kQ+2 i: -5 c ) , IC Jacob i|B#a=(Bj/n) , fejc^f, 

C = mod n, U = /i^<™»> mod n • • • GK2 4) 



?:tf#L F: {0,1}"'*"''°-^{0,1} ^{i^g^;&^>^AKfS[) , (C,D,a) $:Bip^ 

(2) tfffB^'ft#li, (P,q,s,i8) $:MV^T, H^-^iS: (C,D,a) 



[i!t2 5] 



= (CL>*)^r^ mod p, 

. 0(9+1) • ' ' (S:2 5) 

mx,5 = (CI)')^T^mod9 




^nWL, 4> ('»l,p''»l,q).* (-'»l,p»"'l,q).<^ ("l,p»-'»l,q).* (-'»l,p,-'»l,q)i^ 

(x/n)=a}&%c)0<x<2*'~2^^^-^x$:m' ji: L/Ttf-^b (<aL, * litfJHA® 

PJ^^^{C J:^Z/(p)XZ/(q);^)^e>Z/(pq)^®^|^M¥^$:^i-. ) , 

in'j=s'||t' (s'{im'j©±&ntf>y h, t' ttT^k^tf h ) iC^t^fbT, 

[fJC2 6] 

®(?(t'®H(5')) if (C. £») = {C, P') 

• • • GS2 6) 

otherwise 
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m27] 

a = mi V^"*'*^ mod n, ly = /i^('"i> mod n • • • ®C2 7) 




[M^^l 2] 

ii#:^l 1^C^3V^T, tulE^iJim^ (n,g,h,k,a) li, BffgB^m#*'^^fi^ L, 
[ft^^l 3] 

m2 8] 



• J?, 9 : ^IS, p = 3 (mod 4), 9 = 3 (mod 4) 

• s€Z, gh' = 1 (mod pq) 

• /? € Z, a/3 = 1 (mod lcm{p- 1,9 - 1)) 



0^2 8) 




'^-SM^ (p,q,s,/S) $^ic, 
[ii2 9] 



GK29) 



r£^{ikmm (n,g,h,k,l,a) (#L, l(lipq(Z)lf >y h«) , 

(1) i^M#ti, ¥35:1" (0<ii.<2") icMbT. SLIJCr (0<r<2''°) 5:^?^, 



9 
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ms 0] 



mi = m II r ... (^3 0) 




^tmV F: {0,1} "+'^^-{0,1} 'liM^^^> ^*AMiS[T' fell, k=n+kQ+2 

ilf&o ) , S^lCjacobifB-ta=(inj/n). fej;t>*, 
[tSC3 1] 



C = mi^g^^""^^ mod n, D = ft^<'"»> mod « * ' ' 08^3 1 ) 



(2) |ffgH^fB#«, !^^<DUmm (P,q,s,/S) S:fflV%T, Bt-t:^C(C,D,a);^,^eJ 




[fSCS 2] 

gfp-H) 

mi J, = (CI?*) * modp, 

,£is±»i • • • GR32) 

mi,, = (C23*) * mod 5 

*Ji^^aiCj:SZ/(p)XZ/(q)jb^^>Z/(pq)/\®j^|^M^#^^-r„ ) , 



I + otherwi 



otherwise 
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[|5C3 4] 



C' = m',^^<'"'«) mod n, £K = A^^™!) mod n 



GK34) 




[M:^35l 4] 

»^^13lCfcV%T, ifrfEiK5^«# (ii,g,h,k,a) l±, fafBSM#7b^^fiKb, 

[«^3S1 5] 
lt#:^7*^e)^^:^l 4 ^C^V^T, 
d (d^l) (Dm^'^^t.-t^ 

ms 5] 

' i ... (^3 5) 

mod n, mod 73 




® ff® tti ^JLH T 5=- 5: fi ^ -5 
[M^^l 7] 



[f5C3 6] 

= m',"*p'='<'"H mod C; = mi V^*"' ^ mod q 

£>; = mod p**, IT, = /i^^*"'!) mod g 



m3 6) 



1 1 
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mS 7] 



C = C; (modp''), 
D = iy„ (modp"), 



C = C'g (mod q), 
D = D'g (mod g) 



0^3 7) 



ic<fc tj, (C,D) = (C' ,D')S:^lE-r^::^7^^yy$:{i;iS 

[0 0 0 1] 

[0 0 0 2] 

[fie5feC?)fi^^] 

Rivest ,A.Shanir ,L. Adleman. : A method for obtaining digital signatures and 
public-key cryptosystems, Comiiiun. of the ACM, Vol.21, No. 2, pp. 120-126, 

1987. J izmm-^tir\>^^:Bmi3mijm^r-$>^), *t;iiffi^b$tiTv^^^»^ii 

[0 0 0 3] 

■tCDi&lZit, -Xtk2 rT.ElGamal . :A Public Key Cryptosystem and a Signatu 
re Scheme Based on Discrete Logarithms, IEEE Trans. On Information Theor 
y, IT-31, 4, pp. 469-472 (1985) J ICgB^^ tlT VN-&Bir#;^^, -jCMS TM.O.Rab 
in.: Digital Signatures and Public-Key Encryptions as Intractable as Fac 
torization, MIT, Technical Report, MIT/LCS/TR-212 (1979) J ^CfB^c5tlTV^ 
-5Bir-^:&^, -^M,4 rv.S.Miller.rUse of Elliptic Curves in Cryptography, 
Proc. of Crypto' 85, LNCS 218, Spr inger-Verlag, pp. 417-426 (1985) J , -jC^ 
5 rN.Koblitz.: Elliptic Curve Cryptosystems, Math. Comp. , 48, 177, pp.2 
03-209 (1987)j ^tC gB^O^tR ffi^ M V^fe:?^^, rs.Goldwasser and 

S.Micali.: Probabilistic Encryption, JCSS, 28, 2, pp. 270-299 (1984) j tC 

1 2 2000-3011680 




• 
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ga^$tlTV^SHif■^:^^, :Scmi rji.Blum and S.Goldwasser. : An Efficient p 
robabilistic public-key encryption scheme which hides all partial inform 
ation, Proc. of Crypto' 84, LNCS 196, Springer-Verlag, pp. 289-299 (1985) 
J lCfB^$tlTV'»-5>Ht-^:$^^, jiCi^8 rs.Goldwasser and M.Bel lare.: Lecture 
Notes on Cryptography, httpr/www-cse. ucsd.edu/users/mihir/ (1997)j {cfB 
^^tlT t^-SBt#:^r^, :5:1k 9 rR.Cramer and V.Shoup.: A Practical Public 
Key Cryptosystem Provably Secure against Adaptive Chosen Ciphertext Atta 
ck, Proc. of Crypto98, LNCS, Springer-Verlag, pp. 13-25 (1998) j IC|E«$ 
^ tlT V^-S^-^;:©'^, :S:^ 1 O rT.Okamoto and S.Uchiyama, . A New Public-Key C 
ryptosystem as Secure as Factoring, Proc. of Eurocrypt' 98, LNCS, Springe 
r Verlag, pp. 308-318 (1998) j JCfB«$ tlT VASBiF-^:^^, if*^^ e>*lT In 

■So 

[0 0 04] 

i^mm mmm^mmm. Diffie-Heiiman^^r^s, ^) ii}mmx'$>^z.ti <d 

^ffitt ?c s£^ % .& ^2^^||H|-S- CO 3 i: 7? & ■& „ 

^ [0 0 0 5] 

BellareP,{i, ^SCi^ 1 1 TM. Bel lare, A.Desai, D.Pointcheval and P.Rogaway 
,. Re I at ions Among Notions of Security for Public-Key Encryption Schemes, 
Proc. of Crypto' 98, LNCS, Springer Verlagj "e, IND-CCA2 (MjCSfllJ^^^Bif-^ 

35cijc»{c^LT^ij5gT'*§3i:) ^NM-ccA2 (mmmmmm-^:sc^xmizM LX 

[0 0 0 6] 

M^lf, BellareP^li, :Scm 1 2 TM.Bellare and P.Rogaway, .Opt i ma 1 Asymme 
trie Encryption How to Encrypt with RSA, Proc. of Eurocrypt' 94 , LNCS, S 
pringer Verlagj T', -ISSS^i^i: LF^^gm$:IND-CCA2{C^^t-S;&SlCo 
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# 




^(Dr^±:7.i)m:^n^) (D±X'^±m)^umx^^, mm(Dtyy^^M.vitz. 

[0 0 0 7] 



±m ^'^m<D^m^ T«E^fci:^ic, m^xii. ind-cca2 mj^m 

^ ^ ^ ^ It Bif # * =fo ^ ^ -5 ^ # A ^ tl T V ^ S „ 
[0 0 0 8] 



) 



*#g^<D@6&li. mn^:iC:tScmiZMVX-:^\^ (OW-CPA) T^U, 

iscjjc^tc^LT^stE (iND-cPA) x$>^^Ammm-^:&m^m^-t^^tX'^^ 




[0 0 0 9] 

nMmmm^^mmtLxim-ccA2 (^t^itm-cck2) x$>^z.tf)^mmx^ 

[0010] 



ffiiE# 2000-301 1 680 
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[0 0 1 1] 
[0 0 12] 

(1) 3i*^¥35ciic^{c^-rs-:&fni'(4 (ow-cPA) ^mmm.^mmmj: ^) ^MM^j^ 
0 ^mmm-^:scsiiimizM-t^mmm.ii. (ind-cca2) mmm^mmm(Dmm^&. 

[0 0 1 3 ] 

3tiicj:i;, m}^mm^m-^:sc^xmzM-t ^m.mmit (ind-cca2) mmm 

[001 4 ] 

(2) ^g^Con{Cfe^^T^i, fmeU^Ufa il ^g^®Jm^-^t3i±*^ ^ 3^ ^ „ ^^Con 
[0015] 

(3) m^'itcommz-jsi^x , mmw}i^m^^m^^t^mm^m-t. zitnzj:v, 

[0016] 

1 5 aiII4f 2000-301 1680 
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[0 0 17] 

■ttjiiD-h, ^nmit, mmmt)\ ^mm(D^Amm^m^'^xmm^-'$i ^v^^it 

[0 0 18] 

8] 



• G : ^IST — 

• 5 € Z, gh' = 1 (€ F) 



• • • G»3 8) 




a-^ € Z 



[0019] 

[0 0 2 0] 
[ti3 9] 




: G (D^^m 
3,h G 



• - (^39) 



[0 0 2 1] 

^^-S^l^ii (H,g,h,a) ^-f^L (fib, klipq©l^^y hS) , 

(1) mmmit, ^:icm(^u)i3^mmrizMLx, 

[0 0 2 2] 
[f$f4 0] 



C = mV, D = ft' (€G0 ••-GK40) 



1 6 



aiiiE# 2000-3011680 



11 — 239177 



[0 0 2 3] 

(2) msi^m^lt, (H,s,a"b $:MV^T, Bif-^35:(C,D,a):«)>e> 




[0 0 2 4] 
[|$4 1] 

m = {CLfY'^ (e H) • : • 0S4 1 ) 

[0 0 2 5] 




[0 0 2 6] 

:if^mm(D^A^m\i^^:f5m%, s^tc, taia^iiiia'it^ (G,g,h,a) ti. tuiBS-fs 

[0 0 2 7] 

^ h # ^ i: -r -5 =b ® T' ^ S o 
[0 0 2 8] 

1 7 ailiE4t 2000-301 1680 
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[0 0 2 9] 

[0 0 3 0] 
[i5C4 2] 

• Pj 9 • ^li^} p = 3 (mod 4), ^ = 3 (mod 4) 

• « e Z, gh' = l (mod j>g) ... Qgr4 2) 

• € Z, a/3 = 1 (mod lcm(p - 1, g - 1)) 



[0 0 3 1 ] 

:&-£>8J^il (p,q,s,/3) $:{t^L, $^IC, 
[0 0 3 2] 
[fS[4 3] 

• o.ff,^,*,/ € Z (0<i^,ft<n) 

• • • GS:4 3) 

• n = p''g (d tt^) 




[0 0 3 3] 

^^^HH (n,g,h,k,l, a) (>(BL, klipq^lf »y h^g) 

[0 0 3 4] 

(1) mm^it, ¥3S:iB (0<m<2""*'b tCMLT, 

[0 0 3 5] 
m4 4] 



mi = mO*' e G(r) |I r © if(7n0*» ® G(r)) (0 < mi < 2*-') • • • (^4 4) 
[0 0 3 6] 

^tmV (ML, G: {0,1} {0,1}", H: {0,1} "-^{0,1} ''0, ttii^ > ^Ti^gg 

1 8 2000-301 1680 



#5)2 11—239177 



[0 0 3 7] 
[|JC4 5] 

C = nii^'*i7''' mod n, Z? = A'"' mod n • • • GK4 5) 




[0 0 3 8] 
[0 0 3 9] 

(2) }^M(Dm^m (P,q,s,/S) $:MV^T, Bif-^:iC(C,D,a)A^e>, 

[0 04 0] 

m4 6] 



mj J, = (C7£r) * mod p, 
mi., = (C£>')^^modg 



GK4 6) 




[0 0 4 ] ] 

(DMi^^miZ i: ^Z/(p) xz/(q) e>Z/(pq)^(D:g|^M^aS:^-rc 
[0 0 4 2] 

$e)lC, in'j=s'||f (s' tim' j©±firiitr«y t' liT^kg^'^^ ^ l^Ml^T, 
[0 0 4 3] 
[ti4 7] 

e if [5' e G(f ® =0*' ... ^4 7) 

otherwise 




[0 0 4 4] 



§:fff-^L, 3tl$:^-^ft:^*i:-rs «BL. [a] "fe [a] ^«-^tl-rtiacr,±^ 



19 aiBE4t2 0 0 0 - 3 0 1 1 6 8 0 
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[0 0 4 5] 
[0 0 4 6] 

[0 0 4 7] 



y 105, 



106, ^rMATVN^ 



[0 0 4 8] 



3li, ^]6gMlCfett&^M#{|[|^g200CDf^aP=^^?:5^-r 



200 



#^202, m^mM^m^^, tt^#®204, >^^u 




205, mmmU2m, $:fg^TV^^„ 
[0 0 4 9 ] 

[0 0 5 0] 

[0 0 5 1 ] 

[0 0 5 2] 

7li, |liigM5©milS:^-r0T-fe-g>o 
[0 0 5 3] 

14 {"^V^^-momWi) i3J:t>*^^tt (IND-CCA2T'fe^*^) (Z)Jtif$:^-t0Tr 

S>^o 0 8 icfei-t-sifcicTii, 2^5g0^®^^^cfev^Td=3i: L:to *f6^ 

© ^ ^ {C ^ ^ ft ?Bi © I^l © |$[^ li M^O; a A'^ oJIg T- -5 V ^ T |if ^11 o 



2 0 
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[0 0 54] 




(mmm i ) 

^mmcDmmmtLx, ^r, ^^^^scjjc^icmlt-t^i&i (ow-cpa) 
. ^^■^mmw-:ic:^^mizMLx^mm. (ind-cpa) X';^^^mmm-^:Bmiz^^^x 

[0 0 5 5] 
[0 0 5 6] 

m4 8] 



• p, 9 : ^fS, p = 3 (mod 4), 9 = 3 (mod 4) 

• 5 G Z, = 1 (mod pg) 



• GK4 8) 




[0 0 5 7] 
^SllJSgH (P,q,s) $e>JC, 
[0 0 5 8] 
m4 9] 

• a,5,A,A:,i € Z (0<5,^<n) 

... g) 

• n = p^ff (d ft^lgc) 



[0 0 5 9] 

^J^^^mm (n,g,h,k,l) ^j^^t^ (-fiL, ktipq®!^-, h;R) „ 
[0 0 6 0] 

(1) ^^:SCm(Q<m<2^~^)i3J:XJ^^imr (O^r^l) IZMLX, 

[0 0 6 1] 

[igJts 0] 

C=mVniodn, £> = A'" mod n •••GSSO) 



2 1 



ailiEl^ 2000-301 1 680 



[0 0 6 2] 

^im-r-S, $ ?>lCJacobifB-^a=(m/n)$:tt^L, (C,D,a) $:Bt#:jC^ bTlufS^ 

^ ^ IC 7^ To "t" o 

[0 0 6 3] 

(2) ^^#1*, j^^ommm (p,q,s) ^m^^x, Ht•^:^:(c,D,a)*^^>, 

[0 0 64] 
[fS[5 1] 

mi,, = (CD')^ mod q 
[0 0 6 5] 

$:ff-ltb, * (»l,p'»l,q)'* (-»l,p'"l,q)'* ("Lp'-^.q)'-^ (-"l.p'-'l.q)® 

e)t>, (x/n)=a;&^^0<x<2*'"^$:^fe'rx$:^:^Clni:•r^ ({BL/, * HA©M5^ 

^lllCj;§Z/(p)XZ/(q)3?)^e>Z/(pq)^®^|^M¥^^^1'<. ) o 

[0 0 6 6] 



[0 0 6 7] 

±fB^r?i^Bt-^:&S$:^ e>{CSm-t3S:JS[»{CMLT^tJS (IND-CCA2) {C^c 
^ J: e> {C L =b © ©^^JfeM T 5^ o 



[0 0 6 8] 

(lllifeM2) 

- m ?: Bt -i-jlM tC <k o T -r <5 S-^ IC o V N T ii^ -r S . 
[0 0 6 9] 

•to 

[0 0 7 0] 

1. m^^vm 




2 2 
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#5p 1 1 — 2391 77 




[0 0 7 1 ] 
[|5t5 2] 

• p, 9 : 1^1^, p = 3 (mod 4), 9 = 3 (mod 4) 

. . . ^5 2) 

• /9€Z, a/3 = 1 (mod lcm(p- l,g- 1)) 

[0 0 7 2] 

[0 0 7 3] 
[f5C5 3] 

•••GgC53) 




[0 0 7 4] 

[0 0 7 5] 

2. Bif^-^MS 

(1) mmmAit, ^licn. (o<iD<2""''b fc^LT. sLi^^^^^ioi, ^n^m 

[0 0 7 6] 
[f^5 4] 

m, = mO*' eG(r) || r® ff(mO*' ® G(r)) (0 < mj < 2*-=) ' ' ' G»5 4) 

[0 0 7 7] 

$:lt^-r^c <BL, G: {0,1} ""O- {0,1}", H: {0,1} "-^ {0,1} ''O, 

2 3 aiiiE#2 0 0 0 - 3 0 1 1 6 8 0 



S^W- 1 1 — 239177 



[0 0 7 8] 



;#ai02, l?J#?I^#^104$:MV^T, Jacob if 3-ta=(mj/n), fei:tJt, 
[0 0 7 9] 



[fS[5 5] 



C = mi*° mod n 



GK5 5) 




[0 0 8 0] 
[0 0 8 1] 

$e>ic. Hgf-^3S: (c, a) ^mmi 

[0 0 8 2] 



(2) ^m^Bit, '^^tbTV^S_hiBlJ^ 



1 06 5: M V > T M^MSOO $: :^ b T 




[0 0 8 3] 



[|S:5 6] 



* mod 

C « mod q 



(|g[5 6) 



[0084] 

5:ft^L, <t> ('»l,p.°'l,q). (~"l,p'"l,q)' * ^"'l,p'"'"l,q^'* ^""l,p'~'"l,q^® 

e)t>. (x/n)=a;(,^o0<x<2*'"2$:^;t'rx$:iii' j^LTft^-rSc -fib, * licJ^HA 

OM^^^H IC J: ^ Z/ (p) X Z/ (q) ^ 1/ (pq) ^ (Dig ^m-t. 

[0 0 8 5] 

$btC, SI^^|g204$:MlNT, in'j=s'||t' (s* tim' j<Z)±filntr^y h, f liT 



2 4 



ffi|iE# 2000-301 1 680 
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[0 0 8 6] 



m5 7] 



m 




[s' e G{t' e .ff (s'))]"-** if [s' e c?(f ® = o*' 



otherwise 



• • • 



[0 0 8 7] 



[0 0 8 8] 

^ H l^^^-i^ ® SIttt i: ® ^Mtt fc J: »; IE ^ -r ^ i: T ^ ^ c 

[0 0 8 9] 
[0 0 9 0] 

A21C ^ J: e> iC^gl L =tj ® ■& » 
[0 0 9 1 ] 



2 5 
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[0 0 9 2] 
m5 8] 

• p, g : I^IS:, p = 3 (mod 4), 9 = 3 (mod 4) 

• fi € Z, gh' = l (mod pq) ... gg(5 s) 

• /3 € Z, = 1 (mod lcm(p - 1, g - 1)) 




[0 0 9 3] 

^£^mmmm (p,q,s,i8) $:#^b, 

[0 0 9 4] 
[|IC5 9] 

• a,p,A,A;,/€Z (0<ff,ft<n) 



[0 0 9 5] 

:^£^^mmm (n,g,h,k,l,a) ^f^fifeL (fib, klip qCDtf-; h;R^^-ru ) 

^ ';205lC*SMt--2>o 
[0 0 9 6 ] 

(1) mm^Ait, ^35:» (o<iii<2""''b icMLT, M^fife#^ioi, m.w^m 

[0 0 9 7] 
[1^6 0] 

ma = mO*' ® G(r) || r ® J? (mO*' e G'(r)) (0 < m, < 2*-') " ' * (® 6 0) 
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[0 0 9 8] 

^tfM-t^o nV, G: {0,1} 



{0.1}", H: {0,1} "-^{0,1} itmm^J^^y'StJ^ 



[0 0 9 9] 



:^^102, mi^mn^miOAi:m\>^X, JacobiflB-^a=(e.j/n). ^J:tf, 
[0 10 0] 



[Sf 6 1] 




C = mi^°9 mod n, D = hT mod n 



GK61) 




[0101] 
[0 10 2] 

^^K, m-^:SC (C,D,a) $:a#^Ml06$:ffiVNTii«IlI^300$::;M.T^'fi# 
[0 10 3] 

(2) ^^#B{d:, ^wi.r\.^^±mmm^mm (p,q,s,/s) i:, s«#Mi^g2o 
op^®^^^m^a202, mn^m204^m\>^xm^:^{c,D,^) 



[0104] 



[|gC6 2] 

mi^ = (CZ)')^^ mod p, 
mi,, = (CI>')^^mod9 



• m.62) 



[0105] 



^rimt, * (»l,p'«°l,q).* (-'»i,p»'»i,q),* (•"l^p,-"!,^),^ (-«.l^p,-mj ,j)C?) 



2 7 mSEift2 0 0 0 - 3 0 1 1 6 8 0 
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[0106] 



[0 10 7] 



me 3] 



m 




[s' e Git' © 'f W © ® = 0*' 



otherwise 



• • • G&es) 



[0 10 8] 



[0 10 9] 
[Olio] 

me 4 ] 

if' mod n, A'-'modn • • • ®[64) 

[0111] 

[0 1 1 2] 



2 8 
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[0 113] 

(mmm 5 ) 

[0 1 14] 

1. m^^mm 

[0 115] 

me 5] 




• p, g '■ j>= 3 (mod 4), 9 = 3 (mod 4) 

• « € Z, ^ft* = 1 (mod pq) 

• j9 € Z, o/? = 1 (mod lcm(p - 1, 9 - 1)) 



GK6 5) 




[0 116] 

fj^^m^mm (p,q,s,/3) ?:f^^L, 
[0 117] 
[ti66] 

• Q,g,h,k,JeZ {0 < g.h < n) 

• n = p**} (d liiS^IS:) 



(S[66) 



[0 1 1 8] 

^jt^^AmW^ (n,g,h,k,l, a) ^Wmh (Uly, k lip qCDlf hSSr^-r. ) 

[0119] 
2. Pif^-^ft^O-H 

(1) izi^^Aii. (o<Bi<2") ic^LT, ^m^^^mioi, mn^Bios 

2 9 tiJlaE4t 2000-301 1680 
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kO 



$:M^^T, Mr (0<r<2"") ^MXf, 



[0 12 0] 



me 7] 



m, = m © G(r) |( r e (m © G{r)) (0 < mj < 2*=-^) 



GK6 7) 



[0121] 



^tfW--t^. -fBL, G: {0,1} ^'^-^ {0,1}", H: {0,1} "-^{0,1}*'", liig^^7 > ^5?*A 
T-fe*;, k=n+kQ+2 f ■& o 



kO 




[0 12 2] 



^^102, m^^W^mOA^m^^X, JacobifH-^a=(mj/n), J3<kt5 
[0 12 3] 



[|S:6 8] 



C = mi^^y^f*"") mod n, £) = A^t*"*) mod n 



0^68) 




[0 12 4] 

?:ftm-r<5c {BL, F: {0,1}"'^^°->{0,1} '{iig^;&^>^*-^ 
[ 0 ] 2 5] 

$e>lC, Bt-^35C (C,D,a) $:®ffi^fil06$:ffl V^TMIHI|g300S::f^LT^^i% 

B ®^M#«!l^«200{C^'fi-r-6c 
[0126] 



#^202. fKl5^^gl[^a203, ^||^^@204^fl3V^THif-t:^:(C,D,a) 



[0 12 7] 



[f5C6 9] 



mi J, = {CD') * ' mod p, 
mi,, = (CL>')^^ mod g 



«S6 9) 
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[0 12 8] 

^n%L, *C»l,p.«'l,q).*(-"'i,p.">i,q),*("'i,p.-mj q).^(-mj^p,-mj 

ck SZ/ (p) X Z/ (q) A> P, Z/ (pq) /\Cr>^ 
[0 12 9] 




$^IC, ?g^#m04l:^^^T, in'j=s'||t' (s' tim' j^Jtfentf h, V ItT 
[0 13 0] 

mi 0] 

^ I 5' CD © 5(5')) if (C, D) = iC\D') ...(^7 0) 

otherwise 




[0131] 

[0132] 
[f5C7 1] 

C = 7n',^i7^<'"i> mod n, D' ^ mod n •-•(^71) 

[0 1 3 3] 

[0134] 
[0 13 5] 
[0 13 6] 

3 1 ffilE# 2000-301 1680 
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[0 13 7] 
1. H^fi^^H 

[0138] 
[|^7 2] 




• p, g : p = 3 (mod 4), g = 3 (mod 4) 

• 5 € Z, pA* = 1 (mod pq) 

• /3 € Z, a/3 = 1 (mod lcm(p - 1,9 - 1)) 



[0 13 9] 

[0140] 
[fS[7 3] 



GK72) 



• o,^,/j,A:,i e Z (0 < g,h < n) 



QS73) 




[014 1 ] 



(n,g.h,k,I,a) k p q ® ) 

) ^<D 



[0 14 2] 

2. Bif^-^'ft^ll 

(1) mmmAit, (o<i»<2") tcMLT, sLi5(^^^^ioi, mm^mios 

$:Mvm:, £L^r (0<r<2^°) 
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[0 14 3] 
mi 4] 

• • • (jS74) 

mi = m \\ r 



[0144] 

^tm-t^. UL, F: {0,l}"+''°-^{0,l} 'liigS^5>i5fAB8l5tT'^y, k=n+kQ+ 

% [0 14 5] 

$bfC, f|3#feSV^ttS'fi#B;^)^e>J:IH^^5^g|'»^i&#T, ^^#©103, 

^^#©102, 3?J^M##al04$:fl^V^T, JacobifH-^a=(inj/ii), ^3,^0^, 
[0146] 
[tSC7 5] 

C = mj^fr'^*'"*^ mod n, £> = ft^'t'^i) mod n • ■ • ®t7 5) 

[ 0 ] 4 7 ] 
[0148] 

$^{c, Bt#ic (c.D.a) ^mmmmoe^m^'^xmmmmsoo^^fti^x^mm 

B <Z)Sffi#{B!l|gfi200{Cit'fi t- ^ o 
[0 14 9] 



ailiE4t 2000-301 1680 
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[0 1 5 0] 



mi 6] 



= {cry) « mod p, 
"^^1,? = (Ciy) ' mod q 



[0 1 5 1] 




$:tf-^b. * ("l,p'"l,q)'"^(-'»l,p.«'l,q).* ("'i,p.-">i,q).* (-'ni,p.-«'i,q)CZ) 

e)*>. (x/n)=a*^o0<x<2''"2^^;^^x$:■l• ji: LTtf-#-r^o -Cib, * 1*113 HA 
©iH^^StC J: S Z/ (p) X Z/ (q) ^ Z/ (pq) /\(Z)^|gl§5^^ c 



[0152] 



$ e>{c. 



[0 15 3] 



[|iC7 7] 




if (C,£>) = (C',Z)') 
otherwise 



GK7 7) 




[ 0 ] 5 4] 
[0155] 

mi 8^ 



a = m'/°5^<'"'i ) mod n, £>' = /i^t"*'- > mod n 



[0 15 6] 
[0 15 7] 

X, IND-CCA2T'$>-5 3i: ^^-r3i:*^T'#S„ 

3 4 ffifiE#2 0 0 0 - 3 0 1 1 6 8 0 



11-239177 




[0 15 8] 
[0 15 9] 

(mmm i ) 

c?) ^ -f b :^ ^ IC O V ^ T 3* ^ s „ 

[0 1 6 0] 

[0161] 
[tlC7 9] 



C; = m;^°<7^('"i) mod 
Di = /i^^'^i) mod /, 



C7; = m',^"<7''('"S) modg 
= /i'"("'i> mod q 




[0162] 

[0163] 
[f5C8 0] 



C = (^ (modp"^), 



C = (mod g), 



JD = IX, (mod p''), 25 = Pi (mod g) 



(IS8 0) 



[0 1 6 4] 

{CJ:U, (C,D) = (C' ,D')$::^^t--5„ 
[0 16 5] 

immm s ) 

*^iiM{i. J^#i¥35:ij!:»{c^LT^Ssg. -t^^iD-h ind-cpa, T'fe€><2iig§ 
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[0 16 6] 

1. m^^^M 

[0 1 6 7] 

m8 1] 



• p, q : p = 3 (mod 4), g = 3 (mod 4) 

• » 6 Z, s^* = 1 (mod pq) 

• ji? € Z, = 1 (mod lcm(p- 1,9 - 1)) 



QR81) 




[0 16 8] 

i^^^^mm (p,q,s,/s) $:f^^L, 
[0 16 9] 
[i5C8 2] 



a,9,h,k,l€Z^ {0<g,h<n) ...0^8 2) 



• n = p^g (cf ii^) 



[0 1 7 0] 

(n,g,h,k,l,a) ^f^fi^b mL, klip qCDtf-/ h:R$:^-t„ ) 

^^^if, M^<D:&^$:ffi^^-5 3^3^)^BItgT'&-g>„ -^a)ft&(3D'»#lCO V%Tli, ^ 

[0171] 
2. Bt^#M3S 

(1) mm^Ait, ^:iCm (0<m<2^~2) (cMLT, SLMfig^^lOl, ^^#©10 
3§:MV>T. gL|g[r (0<r<l) 
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[0 1 7 2] 



m8 3] 



C =■ m^°'g^' mod n, D = h mod n 



G»8 3) 




[0 17 3] 
[0174] 

$e>tC, ^3#^SVNli^'g#B*^e,±fH^^'K^$:#T, ?am^©103, 
^^#^102, 3?Ji^?gB#ai04%:Mt^T, JacobifH#a=(in/n)$:ft^'r-&c 
[0 17 5] 

$^IC, Bt-^3i: (C,D,a) $:M'filSfil06$:mv^TMmiai^300?::^bT^it# 



[0 17 6] 

(2) ^^#Bli, '^i#bTV>S±iHllJ^ 



(p,q,s,is) t, ^mmm% 



20 



;^^202, ^J5^?IW^^203, ^||^^^204$:fliV^TBif■^:^C(C,D,a) 




[0177] 



mi.g = iCD')^^* mod g 



GBC84) 



[0 17 8] 

0%, (x/n)=a;{)^o0<x<2'^"2$:^fef x^r^^SCn^ bTtfB-t€)„ ffiL. * tt^" 

A<Z)fgl5^^a cfc -5 Z/ (p) X Z/ (q) e> Z/ (pq) ^® ^I^M^^ $:^t-c 
[0 17 9] 



3 7 
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M^CDDiffie-HellmangSt^raMj Hit, mm^^^ 
[0 18 0] 



[^8 5] 



Do 



{h,g,hr,g'-), 0<r<l, 

{h,g,K',Xg'), X = {x/x'f mod n, 0 < 1,1' < 2 



,it-2 



• Ge8 5) 





[0181] 
[0182] 
[0 1 8 3] 

« 7 1 y Z3 > /j; i:' ® It T U , S if # /Jn 5S , g « # M ^ S V n > /.e 



[0184] 



[01 85] 
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[0186] 
[0 18 7] 





[01] 

[®2] 

^ tC ^ l-J ^ illM#«S © $: ^ t- ® T- -5 „ 

[03] 

[S4 ] 

* #g ^ ® leSfeM 2 ® Mil ^ 0 T' ^ o 
[0 5] 

[06] 

[0 7] 

® HiSM 5 ©MM ^"T 0T ^ -5 „ 

[08] 



3 9 
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4f 5p 1 1—239177 



1 0 0 -mmmmmn, i o i -mm^mmm i o o f^©s&l^^^#^. i o 2 
-mm^mmn 1 0 0 [^(D^^mn^m, 1 0 3 100 \H(Dmm- 

1 0 4 -3iiM#«fi 1 0 0 m(Dm^m.n^m, 105 -j^i-fsM^s 1 

mm, 2 0 1 -^m^mmu 200 t^on^sg^©, 202 -^mmmmu 2 0 

Op^^^^^lC^^, 2 0 3 -SM#ffi!l^fi2 0 Op^(Z)3^j3ftm^#a, 2 0 4 - 

^m^mmu2 0 op3(DmM-^M, 2 0 5-sM#{ai^S2 0 oi^©^^ y, 2 
# 0 6 -^m^m^M2 0 0 „ 
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[02] 



gI2 



[H3] 




100 




200 



2 
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[H5] 
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[®6] 
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